Summary
A command injection flaw in the wg-server.generate_publickey function of GL-iNet GL-MT3000 routers allows crafted private_key parameters to break out of expected processing and execute arbitrary system commands.
When the vulnerable CGI endpoint is exposed to untrusted networks, a remote attacker may gain full control of the device by sending malicious HTTP requests.
Affected context
This vulnerability occurs in GL-iNet GL-MT3000 devices running firmware up to version 4.4.5, specifically in the wg-server.so native plugin accessed via the /cgi-bin/glc endpoint.
It manifests when the wg-server.generate_publickey function processes the private_key argument and forwards it, directly or indirectly, into shell-level operations without robust sanitization or proper command construction.
The issue is most relevant when the web administration interface or associated APIs are reachable from untrusted clients, such as over the WAN or shared local networks.
Exploit preconditions
- Attack surface: HTTP-based management/API interface exposed via the /cgi-bin/glc endpoint
- Required access: Network reachability to the router's web interface; may or may not require authentication depending on configuration
- Trigger point: Invocation of wg-server.generate_publickey with a crafted private_key parameter containing shell metacharacters or injected commands
- Why exploitation is possible: The input value is incorporated into a command execution context without adequate neutralization or safe API usage, enabling the attacker to alter command structure and inject arbitrary shell commands
Why this happens
The underlying bug class corresponds to command injection, primarily mapping to CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') and related CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.
Instead of treating the private_key argument as opaque data, the implementation appears to pass it into a shell or shell-invoking function (e.g., system, popen, or equivalent) where shell metacharacters and operators are interpreted.
This pattern arises when application logic composes command strings by concatenating user-controlled input, relies on shell parsing for convenience, and omits strict validation or encoding.
As a result, attackers can transform what should be a simple key-generation operation into a vehicle for arbitrary command execution on the router's operating system.
Potential impact
- Remote execution of arbitrary OS commands on the GL-MT3000 device
- Complete compromise of the router's configuration, including VPN and network settings
- Installation of persistent malware or backdoors on the device
- Interception, modification, or redirection of user network traffic traversing the router
- Use of the compromised router as a pivot point for further attacks on internal networks
- Participation of the device in botnets or large-scale distributed attacks
General mitigation guidance
Effective mitigation focuses on eliminating direct shell command construction and minimizing the trust placed in user-controlled parameters.
Pattern-based defensive measures include:
- Replacing shell-based command execution with library calls or APIs that perform key generation without invoking a shell.
- When command execution is unavoidable, using parameterized process-spawning APIs (e.g., execve-like calls with argument arrays) and avoiding string concatenation entirely.
- Applying strict input validation on parameters like private_key, enforcing expected formats (such as key length, character sets, and structure) and rejecting anything outside defined constraints.
- Normalizing and constraining outputs sent to downstream components so that special characters are either encoded or safely handled, reducing the chance of shell interpretation.
- Running web management components under least-privilege accounts, with restricted filesystem and process capabilities, so that any compromise has reduced blast radius.
- Limiting remote exposure of administrative interfaces through network segmentation, access control lists, or management-only networks to reduce opportunities for exploitation.
How teams detect issues like this
Organizations can approach detection through a combination of code-centric and system-level techniques:
- Static analysis: Configure rules to flag any use of shell-invoking functions (e.g., system, popen, exec with "/bin/sh") where arguments may derive from HTTP parameters such as private_key, especially in CGI handlers or router plugins.
- Code review: During manual review, treat any string-based command construction in web administration code as a high-risk pattern, and verify that untrusted input paths are either sanitized or eliminated.
- Policy enforcement: Enforce development policies that disallow direct shell concatenation in network-exposed components and mandate the use of safer process execution primitives or dedicated libraries.
- Runtime monitoring: Deploy logging and monitoring on router or embedded systems (where feasible) to detect unusual command executions, unexpected processes, or anomalies in CGI handler behavior.
- Automated tooling: Use firmware analysis platforms and SAST tools capable of scanning C/CGI code paths, correlating external inputs (HTTP parameters) to sensitive sinks (command execution) to uncover similar injection flaws.
